feat: certify npm releases across operating systems

[heimanba]

What changed

• Split the release workflow into preflight, npm publish/tag, registry readiness, post-release certification, and final GitHub Release stages.
• Certify the exact published npm versions on Ubuntu, Windows, and macOS with Node.js 22 and 24.
• Add a weekly Node.js 26 compatibility canary across all three operating systems.
• Add a real consumer smoke test for npm provenance/signatures, SDK entry points, CLI help/version/offline validation, and Playground HTTP startup.
• Raise the maintained Node.js baseline to 22 and align CI/documentation with Node.js 22/24.
• Use npm pack --dry-run for registry-independent package inspection so an idempotent retry is not rejected when the version already exists.

Why

A successful npm publish only proves that the registry accepted the tarball. It does not prove that the exact public package can be installed and executed by consumers on the operating systems and Node.js versions we claim to support. The GitHub Release is now the certification signal: it is created only after the public registry artifacts pass the cross-platform matrix.

Impact

• Supported Node.js baseline becomes >=22.
• GitHub Release creation waits for post-publish consumer certification.
• A failed OS/Node combination leaves the npm artifact published but prevents it from being presented as a certified GitHub Release.

Verification

• bun run verify:release in a clean worktree
• repository pre-push verify:push profile
• public npm 0.0.2 consumer smoke on macOS with Node.js 24
• workflow YAML parse and targeted release/governance tests